I have a Cisco ASA that authenticates off of RADIUS / AD. I need to give a user VPN access but I want to limit their access to only one host. What is the best way to do this?
1 Answer
Here is what I ended up doing:
Create a new group-policy that has the split-tunnel with only the host/network I want the VPN user to access. Then create a ACL to only allow network access to what you want. Apply this ACL to the GP with the following command: vpn-filter value (you have to apply this when you are in the GP attributes). Then make a new group-tunnel and tie it back to the new GP. Now you can give this user the new PCF and the user will be locked down to the host / network you specified.
I was hoping to find a solution where I wouldn't have had to make a new GP, TP, and local ASA user but this works I guess.